An eval code injection vulnerability exists in the visualize_data component of mcp-vegalite-server. The function eval processes the vegalite_specification parameter without proper validation, enabling a remote attacker to supply arbitrary JavaScript that is executed on the server. This flaw aligns with CWE-74 (Command Injection) and CWE-94 (Improper Control of Code Generation). Successful exploitation permits the attacker to run code with the server’s permissions, compromising confidentiality, integrity, and availability of the host system.

The vulnerability affects all releases of isaacwasserman’s mcp-vegalite-server up to commit 16aefed598b8cd897b78e99b907f6e2984572c61. Because the project follows a rolling-release model, no specific version numbers are formally released, and no patched revision is publicly identified at this time. Therefore, any instance of the application running the affected code base is potentially vulnerable.

The CVSS score of 5.3 indicates moderate severity, but the vulnerability’s remote code execution potential makes it a significant security concern. The EPSS score of less than 1% suggests that exploitation is currently unlikely or not widely reported; however, the publicly disclosed exploit and lack of an official fix mean that an attacker could still target vulnerable deployments. The issue is not listed in CISA’s KEV catalog, but administrators should still assess whether the application is exposed to untrusted networks and consider immediate remediation.